diff rust/hg-cpython/src/dagops.rs @ 51255:24d3298189d7

rust-index: document safety invariants being upheld for every `unsafe` block

We've added a lot of `unsafe` code that shares Rust structs with Python.
While this is unfortunate, it is also unavoidable, so let's at least
systematically explain why each call to `unsafe` is sound.

If any of the unsafe code ends up being wrong (because everyone screws up
at some point), this change at least continues the unspoken rule of always
explaining the need for `unsafe`, so we at least get a chance to think.

--- a/rust/hg-cpython/src/dagops.rs	Sun Oct 29 12:18:03 2023 +0100
+++ b/rust/hg-cpython/src/dagops.rs	Thu Nov 23 03:41:58 2023 +0100
@@ -28,6 +28,7 @@
     revs: PyObject,
 ) -> PyResult<HashSet<PyRevision>> {
     let py_leaked = py_rust_index_to_graph(py, index)?;
+    // Safety: we don't leak the "faked" reference out of `UnsafePyLeaked`
     let index = &*unsafe { py_leaked.try_borrow(py)? };
     let mut as_set: HashSet<Revision> = rev_pyiter_collect(py, &revs, index)?;
     dagops::retain_heads(index, &mut as_set)